Privacy Policy

Last updated: July 21, 2026.

Christmas Tree Farm Finder is a free directory that helps American families find, evaluate, and visit real Christmas tree farms. We built the site with the same principle that guides the directory itself; be useful, be honest, and do not surprise anyone. This privacy policy explains every category of data the site touches, why we touch it, how long we hold it, and what you can do about any of it. If a specific point below is unclear, write to us at contact@christmastreefarmfinder.com; a human will reply.

Who we are and how to reach us

Christmas Tree Farm Finder ("we", "us", "the site") is operated as an independent editorial project. Our contact address for privacy questions, complaints, and deletion requests is contact@christmastreefarmfinder.com. We respond within 30 days to any lawful request and much faster in practice; usually inside three business days.

Information you provide directly

Most visitors never send us anything at all. If you send a message through the contact form we receive your name, email, and the body of your message. If you submit a farm through the "list your farm" page we receive the details you enter (farm name, address, hours, species, owner name, phone, email, and any notes you include). If you claim an existing farm listing we receive whatever verification you provide (a domain email, a photograph of a business license, or a phone confirmation transcript). We use each of these submissions only for the purpose you gave it to us for; contact-form messages get a reply, farm submissions get published after we verify them, and claim verifications sit in a private support ticket that we close once the listing is transferred.

Information the site collects automatically

Every visit to a public web page generates server logs. We store the IP address, user agent (browser and operating system), URL requested, referrer, and timestamp for each request. Server logs are retained for at most 30 days; after that they are automatically purged. Logs are used to diagnose problems, detect abuse (scraping, credential stuffing, denial-of-service floods), and measure aggregate traffic patterns.

The "Farms Near Me" feature performs an approximate geolocation lookup against your IP address to surface the closest 20 farms in the directory. The IP address is used in memory for the duration of the request only; we do not persist the geolocation result and we do not associate it with any identifier that could be traced back to you personally. If you use the browser's built-in geolocation prompt on that page instead, the coordinates stay in your browser and are sent to our server only for the single lookup.

Cookies and local storage

We use a small number of first-party cookies to remember functional preferences (for example, the state you last searched, whether you dismissed the seasonal banner, and whether you asked us to remember your zip for the near-me page). We do not set advertising cookies, we do not use cookie syncing, and we do not participate in any behavioral advertising network. If you clear your browser cookies for our domain, none of the site's core features stop working.

Analytics

We use a privacy-preserving analytics tool that respects Do Not Track signals; the tool records aggregate page views, referrers, and device categories without setting cross-site cookies and without collecting personal identifiers. If a page or a search returns zero results, the analytics signal helps us decide whether the problem is a missing state, a broken filter, or a slow region. No individual visitor is tracked across sessions.

Third-party embeds

A handful of pages embed content served by third parties; Google Maps for the interactive farm maps, Unsplash for stock photos, and, on selected blog posts, YouTube for embedded videos. Each of these providers may set its own cookies when the embed loads. We use the privacy-enhanced modes of these services wherever the provider offers one; for example, YouTube embeds use the "no-cookie" domain by default. If you would rather not load any third-party embed, most browsers offer a content-blocking extension that suppresses the frame while leaving the rest of the page usable.

How we share information

We do not sell, rent, or trade any personal information. We share personal data with a very small set of vendors, and only to the extent needed to run the service; a managed database provider (Supabase) that stores farm listings and contact messages, a transactional email provider that delivers claim confirmations, and a global content delivery network that caches static assets. Each vendor is bound by a data processing agreement that limits their use of the data to providing the service to us. We publish an updated list of subprocessors on request; email us and we will send the current list.

How long we keep information

Server logs are purged after 30 days. Contact-form messages are kept for at most one year, then deleted. Farm submissions and owner claims are kept for the life of the listing; if a listing is removed at the owner's request, the associated submission record is also removed. Analytics events are aggregated after 60 days; individual event rows are not retained beyond that point.

Your rights

You may request access to, correction of, or deletion of any personal information we hold about you at any time by emailing contact@christmastreefarmfinder.com. We honor requests from all visitors regardless of residence; California, EU, and UK residents additionally have the specific statutory rights described in the CCPA, GDPR, and UK GDPR. We do not charge a fee for the first request in any twelve-month period.

Children's privacy

This site is intended for adults planning family outings. We do not knowingly collect personal information from children under 13. If you believe a child has submitted personal information through the site, please contact us and we will delete the record on receipt.

Security

Data is transmitted over TLS between your browser and our servers. Passwords for owner accounts are hashed with bcrypt at a work factor kept current with modern hardware. Access to the production database is restricted to a small number of engineers, protected by hardware security keys, and logged. No system is perfectly secure; if you discover a vulnerability, please write to contact@christmastreefarmfinder.com and we will respond quickly.

Changes to this policy

We update this policy from time to time as the site evolves. Material changes will be announced with a banner on the home page for at least 30 days before they take effect. The "Last updated" date at the top of this page always reflects the most recent revision. Prior versions are available on request.